Breaking Android Apps
summary
Walks through reversing the Wikipedia APK to change the donation URL to a personal Twitter, rebuilding with apktool and signing with a debug keystore so the modified APK installs, then extracts and displays login inputs by injecting a toast via smali/backsmali generated from Java produced by JADX. Demonstrates APK Analyzer for resources, shows Exposed framework hooks to capture EditText across apps (requires root), and recommends ProGuard, signature checks and SafetyNet to make attacks harder.
AI-written summary · about
chapters (12)
- 0:00Introduction to talk
- 1:16Understanding APK structure
- 6:01Analyzing Wikipedia APK
- 8:06Modifying donation URL
- 9:12Next challenge login credentials
- 11:22Decompiling DEX to Java
- 13:13Injecting code to log credentials
- 16:46Analyzing official code
- 17:53Tracking user input with Xposed
- 20:44Securing apps against attacks
- 22:29About Hotstar and hiring
- 22:55Q&A session
related talks
45mReverse engineering mobile apps: how, why, and what now?
43mAttacking Android Applications
47mAttacking Android Applications
38mReverse Engineering is not just for hackers
44mAuditing Your APKs Like a Black Hat Hacker
37mThe Art of Hiding Sensitive Info in Plain Sight
45mI just hacked your app!
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security